Signature reading was reaching the internet, and three guards could not see it

CHANGELOG.md

@@ -134,6 +134,25 @@ Nothing has been released yet. Everything below is what the tool does today.
 
 ### Fixed
 
+- **Reading signatures no longer contacts anybody. It had been doing so since the beginning.**
+  This tool promises it never talks to the internet, and `bws list --signatures`,
+  `bws snapshot create` and the window all broke that promise: while checking who signed each
+  binary, Windows went out and fetched certificates it did not already hold. Measured three
+  runs out of three, with real connections to a certificate distribution point on the public
+  internet. It uploaded nothing - no list of your services went anywhere - but saying "nothing
+  was sent" would be too generous: a connection carries your address, and **which certificate
+  is asked for says whose software is installed on that machine**. On a tool that runs with
+  administrator rights on somebody else's server, that is the whole point of the promise. It now
+  checks signatures against what your machine already has, and `--follow-network` - the switch
+  that already decided whether a launch path on somebody else's share may be opened - is what
+  lets it reach out again. On the machine this was found on, all 790 signed entries read
+  exactly the same either way, and the listing got faster.
+
+  **Nothing is called untrusted because this tool would not look it up.** If a signature cannot
+  be settled without reaching the network, that entry's signature is reported as unread, with
+  the system's own number and sentence - never as a verdict about the certificate. A file your
+  machine can verify on its own is unaffected. `--follow-network` gives the full answer back.
+
 - **A forced stop whose polite step gave up and whose kill worked no longer reports failure.**
   The sheet said "the entry is not where you asked" and the command line returned exit code 3
   over an entry standing exactly where every step wanted it, because the verdict counted steps

site/i18n/en.json

@@ -44,7 +44,7 @@
   "switch.signatures": "Read who signed each binary and whether Windows trusts it. Several seconds over a whole machine, so it is off unless asked - and a query about signatures turns it on by itself.",
   "switch.memory": "Read what each running entry's process is using. Off by default because it is a measurement rather than a setting: it is different a second later.",
   "switch.required-by": "Read which entries break if one is stopped, asked of Windows directly rather than worked out from what everything declares. A call per entry, so off unless asked. <code>show</code> and <code>snapshot create</code> read it every time.",
-  "switch.follow-network": "Let the tool look at a launch path that lives on another machine. Off by default for safety: one unreachable share costs twenty one seconds, and the connection authenticates as whoever ran it.",
+  "switch.follow-network": "Let the tool reach off this machine at all - a launch path living on somebody else's share, and a certificate this machine does not already hold. Off by default for safety: one unreachable share costs twenty one seconds and authenticates as whoever ran it, and fetching a certificate is a connection to a third party in the middle of an ordinary listing. Without it a signature is checked against what is here, and a result that might have been caused by not looking is reported as unread rather than as a verdict.",
   "switch.force": "On <code>kill</code>, end the process straight away without asking politely - the preview then shows one step instead of two. On <code>snapshot create</code>, write over a file that is already there.",
   "switch.restart": "On <code>kill</code>, bring the entry back once the process is gone, along with everything that shared it.",
   "switch.full": "On <code>show</code>, print the fields that are genuinely empty as well. A field nobody could read is printed either way.",

site/i18n/pl.json

@@ -44,7 +44,7 @@
   "switch.signatures": "Czyta, kto podpisał każdy plik i czy Windows temu podpisowi ufa. Kilka sekund na całej maszynie, więc jest wyłączone, dopóki nie poprosisz - a zapytanie o podpisy włącza to samo.",
   "switch.memory": "Czyta, ile pamięci zajmuje proces każdego działającego wpisu. Domyślnie wyłączone, bo to pomiar, a nie ustawienie: sekundę później jest inny.",
   "switch.required-by": "Czyta, które wpisy przestaną działać po zatrzymaniu tego - pytając Windows wprost, zamiast wyliczać to z deklaracji. Jedno wywołanie na wpis, więc wyłączone, dopóki nie poprosisz. <code>show</code> i <code>snapshot create</code> czytają to zawsze.",
-  "switch.follow-network": "Pozwala zajrzeć pod ścieżkę uruchomienia leżącą na innej maszynie. Domyślnie wyłączone dla bezpieczeństwa: jeden nieosiągalny udział kosztuje dwadzieścia jeden sekund, a połączenie uwierzytelnia się jako ten, kto uruchomił program.",
+  "switch.follow-network": "Pozwala programowi sięgnąć poza tę maszynę - pod ścieżkę uruchomienia leżącą na udziale innego komputera oraz po certyfikat, którego ta maszyna jeszcze nie ma. Domyślnie wyłączone dla bezpieczeństwa: jeden nieosiągalny udział kosztuje dwadzieścia jeden sekund i uwierzytelnia się jako ten, kto uruchomił program, a pobranie certyfikatu to połączenie do obcego serwera w trakcie zwykłego listowania. Bez tego podpis jest sprawdzany wobec tego, co jest na miejscu, a wynik, który mógł wziąć się z niezajrzenia, jest zgłaszany jako nieodczytany, a nie jako werdykt.",
   "switch.force": "Przy <code>kill</code> kończy proces od razu, bez uprzejmego pytania - podgląd pokazuje wtedy jeden krok zamiast dwóch. Przy <code>snapshot create</code> nadpisuje istniejący plik.",
   "switch.restart": "Przy <code>kill</code> podnosi wpis z powrotem, gdy proces zniknie, razem ze wszystkim, co ten proces dzieliło.",
   "switch.full": "Przy <code>show</code> drukuje także pola, które są naprawdę puste. Pole, którego nie dało się odczytać, drukuje się i tak.",